generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

IMAP/POP3/SMTP: use a per-connection sub-structure for SASL parameters.

Browse Source
This commit is contained in:
Patrick Monnerat
2015-01-20 14:14:26 +01:00
parent 960b04e137
commit 5f09cbcdbd
7 changed files with 176 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/curl_sasl.h
View File

@@ -68,6 +68,14 @@ enum {
CURLDIGESTALGO_MD5SESS CURLDIGESTALGO_MD5SESS
}; };
/* Per-connection parameters */
struct SASL {
unsigned int authmechs; /* Accepted authentication mechanisms */
unsigned int prefmech; /* Preferred authentication mechanism */
unsigned int authused; /* Auth mechanism used for the connection */
bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
};
/* This is used to test whether the line starts with the given mechanism */ /* This is used to test whether the line starts with the given mechanism */
#define sasl_mech_equal(line, wordlen, mech) \ #define sasl_mech_equal(line, wordlen, mech) \
(wordlen == (sizeof(mech) - 1) / sizeof(char) && \ (wordlen == (sizeof(mech) - 1) / sizeof(char) && \

102
lib/imap.c
View File

@@ -471,8 +471,8 @@ static CURLcode imap_perform_capability(struct connectdata *conn)
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
struct imap_conn *imapc = &conn->proto.imapc; struct imap_conn *imapc = &conn->proto.imapc;
imapc->authmechs = 0; /* No known authentication mechanisms yet */ imapc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
imapc->authused = 0; /* Clear the authentication mechanism used */ imapc->sasl.authused = SASL_AUTH_NONE; /* Clear the auth. mechanism used */
imapc->tls_supported = FALSE; /* Clear the TLS capability */ imapc->tls_supported = FALSE; /* Clear the TLS capability */
/* Send the CAPABILITY command */ /* Send the CAPABILITY command */
@@ -919,21 +919,21 @@ static CURLcode imap_state_capability_resp(struct connectdata *conn,
/* Test the word for a matching authentication mechanism */ /* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN)) if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
imapc->authmechs |= SASL_MECH_LOGIN; imapc->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
imapc->authmechs |= SASL_MECH_PLAIN; imapc->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
imapc->authmechs |= SASL_MECH_CRAM_MD5; imapc->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
imapc->authmechs |= SASL_MECH_DIGEST_MD5; imapc->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
imapc->authmechs |= SASL_MECH_GSSAPI; imapc->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
imapc->authmechs |= SASL_MECH_EXTERNAL; imapc->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
imapc->authmechs |= SASL_MECH_NTLM; imapc->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
imapc->authmechs |= SASL_MECH_XOAUTH2; imapc->sasl.authmechs |= SASL_MECH_XOAUTH2;
} }
line += wordlen; line += wordlen;
@@ -1321,7 +1321,7 @@ static CURLcode imap_state_auth_gssapi_resp(struct connectdata *conn,
/* Create the initial response message */ /* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "imap", conn->passwd, "imap",
imapc->mutual_auth, imapc->sasl.mutual_auth,
NULL, &conn->krb5, NULL, &conn->krb5,
&respmsg, &len); &respmsg, &len);
if(!result && respmsg) { if(!result && respmsg) {
@@ -1360,11 +1360,11 @@ static CURLcode imap_state_auth_gssapi_token_resp(struct connectdata *conn,
/* Get the challenge message */ /* Get the challenge message */
imap_get_message(data->state.buffer, &chlgmsg); imap_get_message(data->state.buffer, &chlgmsg);
if(imapc->mutual_auth) if(imapc->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response /* Decode the user token challenge and create the optional response
message */ message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL, result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
imapc->mutual_auth, imapc->sasl.mutual_auth,
chlgmsg, &conn->krb5, chlgmsg, &conn->krb5,
&respmsg, &len); &respmsg, &len);
else else
@@ -1390,8 +1390,8 @@ static CURLcode imap_state_auth_gssapi_token_resp(struct connectdata *conn,
result = Curl_pp_sendf(&imapc->pp, "%s", ""); result = Curl_pp_sendf(&imapc->pp, "%s", "");
if(!result) if(!result)
state(conn, (imapc->mutual_auth ? IMAP_AUTHENTICATE_GSSAPI_NO_DATA : state(conn, imapc->sasl.mutual_auth? IMAP_AUTHENTICATE_GSSAPI_NO_DATA:
IMAP_AUTHENTICATE_FINAL)); IMAP_AUTHENTICATE_FINAL);
} }
} }
@@ -1504,7 +1504,7 @@ static CURLcode imap_state_auth_cancel_resp(struct connectdata *conn,
(void)instate; /* no use for this yet */ (void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */ /* Remove the offending mechanism from the supported list */
imapc->authmechs ^= imapc->authused; imapc->sasl.authmechs ^= imapc->sasl.authused;
/* Calculate alternative SASL login details */ /* Calculate alternative SASL login details */
result = imap_calc_sasl_details(conn, &mech, &initresp, &len, &state1, result = imap_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
@@ -2061,7 +2061,7 @@ static CURLcode imap_connect(struct connectdata *conn, bool *done)
/* Set the default preferred authentication type and mechanism */ /* Set the default preferred authentication type and mechanism */
imapc->preftype = IMAP_TYPE_ANY; imapc->preftype = IMAP_TYPE_ANY;
imapc->prefmech = SASL_AUTH_ANY; imapc->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */ /* Initialise the pingpong layer */
Curl_pp_init(pp); Curl_pp_init(pp);
@@ -2274,7 +2274,7 @@ static CURLcode imap_disconnect(struct connectdata *conn, bool dead_connection)
Curl_pp_disconnect(&imapc->pp); Curl_pp_disconnect(&imapc->pp);
/* Cleanup the SASL module */ /* Cleanup the SASL module */
Curl_sasl_cleanup(conn, imapc->authused); Curl_sasl_cleanup(conn, imapc->sasl.authused);
/* Cleanup our connection based variables */ /* Cleanup our connection based variables */
Curl_safefree(imapc->mailbox); Curl_safefree(imapc->mailbox);
@@ -2565,7 +2565,7 @@ static CURLcode imap_parse_url_options(struct connectdata *conn)
if(reset) { if(reset) {
reset = FALSE; reset = FALSE;
imapc->preftype = IMAP_TYPE_NONE; imapc->preftype = IMAP_TYPE_NONE;
imapc->prefmech = SASL_AUTH_NONE; imapc->sasl.prefmech = SASL_AUTH_NONE;
} }
while(*ptr && *ptr != ';') { while(*ptr && *ptr != ';') {
@@ -2575,35 +2575,35 @@ static CURLcode imap_parse_url_options(struct connectdata *conn)
if(strnequal(value, "*", len)) { if(strnequal(value, "*", len)) {
imapc->preftype = IMAP_TYPE_ANY; imapc->preftype = IMAP_TYPE_ANY;
imapc->prefmech = SASL_AUTH_ANY; imapc->sasl.prefmech = SASL_AUTH_ANY;
} }
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) { else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_LOGIN; imapc->sasl.prefmech |= SASL_MECH_LOGIN;
} }
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) { else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_PLAIN; imapc->sasl.prefmech |= SASL_MECH_PLAIN;
} }
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) { else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_CRAM_MD5; imapc->sasl.prefmech |= SASL_MECH_CRAM_MD5;
} }
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) { else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_DIGEST_MD5; imapc->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
} }
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) { else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_GSSAPI; imapc->sasl.prefmech |= SASL_MECH_GSSAPI;
} }
else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) { else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_NTLM; imapc->sasl.prefmech |= SASL_MECH_NTLM;
} }
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) { else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) {
imapc->preftype = IMAP_TYPE_SASL; imapc->preftype = IMAP_TYPE_SASL;
imapc->prefmech |= SASL_MECH_XOAUTH2; imapc->sasl.prefmech |= SASL_MECH_XOAUTH2;
} }
if(*ptr == ';') if(*ptr == ';')
@@ -2803,46 +2803,46 @@ static CURLcode imap_calc_sasl_details(struct connectdata *conn,
/* Calculate the supported authentication mechanism, by decreasing order of /* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */ security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5) #if defined(USE_KERBEROS5)
if((imapc->authmechs & SASL_MECH_GSSAPI) && if((imapc->sasl.authmechs & SASL_MECH_GSSAPI) &&
(imapc->prefmech & SASL_MECH_GSSAPI)) { (imapc->sasl.prefmech & SASL_MECH_GSSAPI)) {
imapc->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ imapc->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI; *mech = SASL_MECH_STRING_GSSAPI;
*state1 = IMAP_AUTHENTICATE_GSSAPI; *state1 = IMAP_AUTHENTICATE_GSSAPI;
*state2 = IMAP_AUTHENTICATE_GSSAPI_TOKEN; *state2 = IMAP_AUTHENTICATE_GSSAPI_TOKEN;
imapc->authused = SASL_MECH_GSSAPI; imapc->sasl.authused = SASL_MECH_GSSAPI;
if(imapc->ir_supported || data->set.sasl_ir) if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "imap", conn->passwd, "imap",
imapc->mutual_auth, imapc->sasl.mutual_auth,
NULL, &conn->krb5, NULL, &conn->krb5,
initresp, len); initresp, len);
} }
else else
#endif #endif
#ifndef CURL_DISABLE_CRYPTO_AUTH #ifndef CURL_DISABLE_CRYPTO_AUTH
if((imapc->authmechs & SASL_MECH_DIGEST_MD5) && if((imapc->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
(imapc->prefmech & SASL_MECH_DIGEST_MD5)) { (imapc->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5; *mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = IMAP_AUTHENTICATE_DIGESTMD5; *state1 = IMAP_AUTHENTICATE_DIGESTMD5;
imapc->authused = SASL_MECH_DIGEST_MD5; imapc->sasl.authused = SASL_MECH_DIGEST_MD5;
} }
else if((imapc->authmechs & SASL_MECH_CRAM_MD5) && else if((imapc->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
(imapc->prefmech & SASL_MECH_CRAM_MD5)) { (imapc->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5; *mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = IMAP_AUTHENTICATE_CRAMMD5; *state1 = IMAP_AUTHENTICATE_CRAMMD5;
imapc->authused = SASL_MECH_CRAM_MD5; imapc->sasl.authused = SASL_MECH_CRAM_MD5;
} }
else else
#endif #endif
#ifdef USE_NTLM #ifdef USE_NTLM
if((imapc->authmechs & SASL_MECH_NTLM) && if((imapc->sasl.authmechs & SASL_MECH_NTLM) &&
(imapc->prefmech & SASL_MECH_NTLM)) { (imapc->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM; *mech = SASL_MECH_STRING_NTLM;
*state1 = IMAP_AUTHENTICATE_NTLM; *state1 = IMAP_AUTHENTICATE_NTLM;
*state2 = IMAP_AUTHENTICATE_NTLM_TYPE2MSG; *state2 = IMAP_AUTHENTICATE_NTLM_TYPE2MSG;
imapc->authused = SASL_MECH_NTLM; imapc->sasl.authused = SASL_MECH_NTLM;
if(imapc->ir_supported || data->set.sasl_ir) if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd, result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
@@ -2851,35 +2851,35 @@ static CURLcode imap_calc_sasl_details(struct connectdata *conn,
} }
else else
#endif #endif
if(((imapc->authmechs & SASL_MECH_XOAUTH2) && if(((imapc->sasl.authmechs & SASL_MECH_XOAUTH2) &&
(imapc->prefmech & SASL_MECH_XOAUTH2) && (imapc->sasl.prefmech & SASL_MECH_XOAUTH2) &&
(imapc->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) { (imapc->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2; *mech = SASL_MECH_STRING_XOAUTH2;
*state1 = IMAP_AUTHENTICATE_XOAUTH2; *state1 = IMAP_AUTHENTICATE_XOAUTH2;
*state2 = IMAP_AUTHENTICATE_FINAL; *state2 = IMAP_AUTHENTICATE_FINAL;
imapc->authused = SASL_MECH_XOAUTH2; imapc->sasl.authused = SASL_MECH_XOAUTH2;
if(imapc->ir_supported || data->set.sasl_ir) if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user, result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer, conn->xoauth2_bearer,
initresp, len); initresp, len);
} }
else if((imapc->authmechs & SASL_MECH_LOGIN) && else if((imapc->sasl.authmechs & SASL_MECH_LOGIN) &&
(imapc->prefmech & SASL_MECH_LOGIN)) { (imapc->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN; *mech = SASL_MECH_STRING_LOGIN;
*state1 = IMAP_AUTHENTICATE_LOGIN; *state1 = IMAP_AUTHENTICATE_LOGIN;
*state2 = IMAP_AUTHENTICATE_LOGIN_PASSWD; *state2 = IMAP_AUTHENTICATE_LOGIN_PASSWD;
imapc->authused = SASL_MECH_LOGIN; imapc->sasl.authused = SASL_MECH_LOGIN;
if(imapc->ir_supported || data->set.sasl_ir) if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len); result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
} }
else if((imapc->authmechs & SASL_MECH_PLAIN) && else if((imapc->sasl.authmechs & SASL_MECH_PLAIN) &&
(imapc->prefmech & SASL_MECH_PLAIN)) { (imapc->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN; *mech = SASL_MECH_STRING_PLAIN;
*state1 = IMAP_AUTHENTICATE_PLAIN; *state1 = IMAP_AUTHENTICATE_PLAIN;
*state2 = IMAP_AUTHENTICATE_FINAL; *state2 = IMAP_AUTHENTICATE_FINAL;
imapc->authused = SASL_MECH_PLAIN; imapc->sasl.authused = SASL_MECH_PLAIN;
if(imapc->ir_supported || data->set.sasl_ir) if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd, result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,

6
lib/imap.h
View File

@@ -23,6 +23,7 @@
***************************************************************************/ ***************************************************************************/
#include "pingpong.h" #include "pingpong.h"
#include "curl_sasl.h"
/**************************************************************************** /****************************************************************************
* IMAP unique setup * IMAP unique setup
@@ -83,16 +84,13 @@ struct imap_conn {
struct pingpong pp; struct pingpong pp;
imapstate state; /* Always use imap.c:state() to change state! */ imapstate state; /* Always use imap.c:state() to change state! */
bool ssldone; /* Is connect() over SSL done? */ bool ssldone; /* Is connect() over SSL done? */
unsigned int authmechs; /* Accepted authentication mechanisms */ struct SASL sasl; /* SASL-related parameters */
unsigned int preftype; /* Preferred authentication type */ unsigned int preftype; /* Preferred authentication type */
unsigned int prefmech; /* Preferred authentication mechanism */
unsigned int authused; /* Auth mechanism used for the connection */
int cmdid; /* Last used command ID */ int cmdid; /* Last used command ID */
char resptag[5]; /* Response tag to wait for */ char resptag[5]; /* Response tag to wait for */
bool tls_supported; /* StartTLS capability supported by server */ bool tls_supported; /* StartTLS capability supported by server */
bool login_disabled; /* LOGIN command disabled by server */ bool login_disabled; /* LOGIN command disabled by server */
bool ir_supported; /* Initial response supported by server */ bool ir_supported; /* Initial response supported by server */
bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
char *mailbox; /* The last selected mailbox */ char *mailbox; /* The last selected mailbox */
char *mailbox_uidvalidity; /* UIDVALIDITY parsed from select response */ char *mailbox_uidvalidity; /* UIDVALIDITY parsed from select response */
}; };

102
lib/pop3.c
View File

@@ -354,8 +354,8 @@ static CURLcode pop3_perform_capa(struct connectdata *conn)
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
struct pop3_conn *pop3c = &conn->proto.pop3c; struct pop3_conn *pop3c = &conn->proto.pop3c;
pop3c->authmechs = 0; /* No known authentication mechanisms yet */ pop3c->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
pop3c->authused = 0; /* Clear the authentication mechanism used */ pop3c->sasl.authused = SASL_AUTH_NONE; /* Clear the auth. mechanism used */
pop3c->tls_supported = FALSE; /* Clear the TLS capability */ pop3c->tls_supported = FALSE; /* Clear the TLS capability */
/* Send the CAPA command */ /* Send the CAPA command */
@@ -745,21 +745,21 @@ static CURLcode pop3_state_capa_resp(struct connectdata *conn, int pop3code,
/* Test the word for a matching authentication mechanism */ /* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN)) if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
pop3c->authmechs |= SASL_MECH_LOGIN; pop3c->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
pop3c->authmechs |= SASL_MECH_PLAIN; pop3c->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
pop3c->authmechs |= SASL_MECH_CRAM_MD5; pop3c->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
pop3c->authmechs |= SASL_MECH_DIGEST_MD5; pop3c->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
pop3c->authmechs |= SASL_MECH_GSSAPI; pop3c->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
pop3c->authmechs |= SASL_MECH_EXTERNAL; pop3c->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
pop3c->authmechs |= SASL_MECH_NTLM; pop3c->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
pop3c->authmechs |= SASL_MECH_XOAUTH2; pop3c->sasl.authmechs |= SASL_MECH_XOAUTH2;
line += wordlen; line += wordlen;
len -= wordlen; len -= wordlen;
@@ -1152,7 +1152,7 @@ static CURLcode pop3_state_auth_gssapi_resp(struct connectdata *conn,
/* Create the initial response message */ /* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "pop", conn->passwd, "pop",
pop3c->mutual_auth, pop3c->sasl.mutual_auth,
NULL, &conn->krb5, NULL, &conn->krb5,
&respmsg, &len); &respmsg, &len);
if(!result && respmsg) { if(!result && respmsg) {
@@ -1191,11 +1191,11 @@ static CURLcode pop3_state_auth_gssapi_token_resp(struct connectdata *conn,
/* Get the challenge message */ /* Get the challenge message */
pop3_get_message(data->state.buffer, &chlgmsg); pop3_get_message(data->state.buffer, &chlgmsg);
if(pop3c->mutual_auth) if(pop3c->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response /* Decode the user token challenge and create the optional response
message */ message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL, result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
pop3c->mutual_auth, pop3c->sasl.mutual_auth,
chlgmsg, &conn->krb5, chlgmsg, &conn->krb5,
&respmsg, &len); &respmsg, &len);
else else
@@ -1221,7 +1221,7 @@ static CURLcode pop3_state_auth_gssapi_token_resp(struct connectdata *conn,
result = Curl_pp_sendf(&pop3c->pp, "%s", ""); result = Curl_pp_sendf(&pop3c->pp, "%s", "");
if(!result) if(!result)
state(conn, (pop3c->mutual_auth ? POP3_AUTH_GSSAPI_NO_DATA : state(conn, (pop3c->sasl.mutual_auth ? POP3_AUTH_GSSAPI_NO_DATA :
POP3_AUTH_FINAL)); POP3_AUTH_FINAL));
} }
} }
@@ -1334,7 +1334,7 @@ static CURLcode pop3_state_auth_cancel_resp(struct connectdata *conn,
(void)instate; /* no use for this yet */ (void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */ /* Remove the offending mechanism from the supported list */
pop3c->authmechs ^= pop3c->authused; pop3c->sasl.authmechs ^= pop3c->sasl.authused;
/* Calculate alternative SASL login details */ /* Calculate alternative SASL login details */
result = pop3_calc_sasl_details(conn, &mech, &initresp, &len, &state1, result = pop3_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
@@ -1727,7 +1727,7 @@ static CURLcode pop3_connect(struct connectdata *conn, bool *done)
/* Set the default preferred authentication type and mechanism */ /* Set the default preferred authentication type and mechanism */
pop3c->preftype = POP3_TYPE_ANY; pop3c->preftype = POP3_TYPE_ANY;
pop3c->prefmech = SASL_AUTH_ANY; pop3c->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */ /* Initialise the pingpong layer */
Curl_pp_init(pp); Curl_pp_init(pp);
@@ -1879,7 +1879,7 @@ static CURLcode pop3_disconnect(struct connectdata *conn, bool dead_connection)
Curl_pp_disconnect(&pop3c->pp); Curl_pp_disconnect(&pop3c->pp);
/* Cleanup the SASL module */ /* Cleanup the SASL module */
Curl_sasl_cleanup(conn, pop3c->authused); Curl_sasl_cleanup(conn, pop3c->sasl.authused);
/* Cleanup our connection based variables */ /* Cleanup our connection based variables */
Curl_safefree(pop3c->apoptimestamp); Curl_safefree(pop3c->apoptimestamp);
@@ -2011,7 +2011,7 @@ static CURLcode pop3_parse_url_options(struct connectdata *conn)
if(reset) { if(reset) {
reset = FALSE; reset = FALSE;
pop3c->preftype = POP3_TYPE_NONE; pop3c->preftype = POP3_TYPE_NONE;
pop3c->prefmech = SASL_AUTH_NONE; pop3c->sasl.prefmech = SASL_AUTH_NONE;
} }
while(*ptr && *ptr != ';') { while(*ptr && *ptr != ';') {
@@ -2021,39 +2021,39 @@ static CURLcode pop3_parse_url_options(struct connectdata *conn)
if(strnequal(value, "*", len)) { if(strnequal(value, "*", len)) {
pop3c->preftype = POP3_TYPE_ANY; pop3c->preftype = POP3_TYPE_ANY;
pop3c->prefmech = SASL_AUTH_ANY; pop3c->sasl.prefmech = SASL_AUTH_ANY;
} }
else if(strnequal(value, "+APOP", len)) { else if(strnequal(value, "+APOP", len)) {
pop3c->preftype = POP3_TYPE_APOP; pop3c->preftype = POP3_TYPE_APOP;
pop3c->prefmech = SASL_AUTH_NONE; pop3c->sasl.prefmech = SASL_AUTH_NONE;
} }
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) { else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_LOGIN; pop3c->sasl.prefmech |= SASL_MECH_LOGIN;
} }
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) { else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_PLAIN; pop3c->sasl.prefmech |= SASL_MECH_PLAIN;
} }
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) { else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_CRAM_MD5; pop3c->sasl.prefmech |= SASL_MECH_CRAM_MD5;
} }
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) { else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_DIGEST_MD5; pop3c->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
} }
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) { else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_GSSAPI; pop3c->sasl.prefmech |= SASL_MECH_GSSAPI;
} }
else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) { else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_NTLM; pop3c->sasl.prefmech |= SASL_MECH_NTLM;
} }
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) { else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) {
pop3c->preftype = POP3_TYPE_SASL; pop3c->preftype = POP3_TYPE_SASL;
pop3c->prefmech |= SASL_MECH_XOAUTH2; pop3c->sasl.prefmech |= SASL_MECH_XOAUTH2;
} }
if(*ptr == ';') if(*ptr == ';')
@@ -2121,46 +2121,46 @@ static CURLcode pop3_calc_sasl_details(struct connectdata *conn,
/* Calculate the supported authentication mechanism, by decreasing order of /* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */ security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5) #if defined(USE_KERBEROS5)
if((pop3c->authmechs & SASL_MECH_GSSAPI) && if((pop3c->sasl.authmechs & SASL_MECH_GSSAPI) &&
(pop3c->prefmech & SASL_MECH_GSSAPI)) { (pop3c->sasl.prefmech & SASL_MECH_GSSAPI)) {
pop3c->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ pop3c->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI; *mech = SASL_MECH_STRING_GSSAPI;
*state1 = POP3_AUTH_GSSAPI; *state1 = POP3_AUTH_GSSAPI;
*state2 = POP3_AUTH_GSSAPI_TOKEN; *state2 = POP3_AUTH_GSSAPI_TOKEN;
pop3c->authused = SASL_MECH_GSSAPI; pop3c->sasl.authused = SASL_MECH_GSSAPI;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "pop", conn->passwd, "pop",
pop3c->mutual_auth, pop3c->sasl.mutual_auth,
NULL, &conn->krb5, NULL, &conn->krb5,
initresp, len); initresp, len);
} }
else else
#endif #endif
#ifndef CURL_DISABLE_CRYPTO_AUTH #ifndef CURL_DISABLE_CRYPTO_AUTH
if((pop3c->authmechs & SASL_MECH_DIGEST_MD5) && if((pop3c->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
(pop3c->prefmech & SASL_MECH_DIGEST_MD5)) { (pop3c->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5; *mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = POP3_AUTH_DIGESTMD5; *state1 = POP3_AUTH_DIGESTMD5;
pop3c->authused = SASL_MECH_DIGEST_MD5; pop3c->sasl.authused = SASL_MECH_DIGEST_MD5;
} }
else if((pop3c->authmechs & SASL_MECH_CRAM_MD5) && else if((pop3c->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
(pop3c->prefmech & SASL_MECH_CRAM_MD5)) { (pop3c->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5; *mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = POP3_AUTH_CRAMMD5; *state1 = POP3_AUTH_CRAMMD5;
pop3c->authused = SASL_MECH_CRAM_MD5; pop3c->sasl.authused = SASL_MECH_CRAM_MD5;
} }
else else
#endif #endif
#ifdef USE_NTLM #ifdef USE_NTLM
if((pop3c->authmechs & SASL_MECH_NTLM) && if((pop3c->sasl.authmechs & SASL_MECH_NTLM) &&
(pop3c->prefmech & SASL_MECH_NTLM)) { (pop3c->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM; *mech = SASL_MECH_STRING_NTLM;
*state1 = POP3_AUTH_NTLM; *state1 = POP3_AUTH_NTLM;
*state2 = POP3_AUTH_NTLM_TYPE2MSG; *state2 = POP3_AUTH_NTLM_TYPE2MSG;
pop3c->authused = SASL_MECH_NTLM; pop3c->sasl.authused = SASL_MECH_NTLM;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd, result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
@@ -2169,35 +2169,35 @@ static CURLcode pop3_calc_sasl_details(struct connectdata *conn,
} }
else else
#endif #endif
if(((pop3c->authmechs & SASL_MECH_XOAUTH2) && if(((pop3c->sasl.authmechs & SASL_MECH_XOAUTH2) &&
(pop3c->prefmech & SASL_MECH_XOAUTH2) && (pop3c->sasl.prefmech & SASL_MECH_XOAUTH2) &&
(pop3c->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) { (pop3c->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2; *mech = SASL_MECH_STRING_XOAUTH2;
*state1 = POP3_AUTH_XOAUTH2; *state1 = POP3_AUTH_XOAUTH2;
*state2 = POP3_AUTH_FINAL; *state2 = POP3_AUTH_FINAL;
pop3c->authused = SASL_MECH_XOAUTH2; pop3c->sasl.authused = SASL_MECH_XOAUTH2;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user, result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer, conn->xoauth2_bearer,
initresp, len); initresp, len);
} }
else if((pop3c->authmechs & SASL_MECH_LOGIN) && else if((pop3c->sasl.authmechs & SASL_MECH_LOGIN) &&
(pop3c->prefmech & SASL_MECH_LOGIN)) { (pop3c->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN; *mech = SASL_MECH_STRING_LOGIN;
*state1 = POP3_AUTH_LOGIN; *state1 = POP3_AUTH_LOGIN;
*state2 = POP3_AUTH_LOGIN_PASSWD; *state2 = POP3_AUTH_LOGIN_PASSWD;
pop3c->authused = SASL_MECH_LOGIN; pop3c->sasl.authused = SASL_MECH_LOGIN;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len); result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
} }
else if((pop3c->authmechs & SASL_MECH_PLAIN) && else if((pop3c->sasl.authmechs & SASL_MECH_PLAIN) &&
(pop3c->prefmech & SASL_MECH_PLAIN)) { (pop3c->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN; *mech = SASL_MECH_STRING_PLAIN;
*state1 = POP3_AUTH_PLAIN; *state1 = POP3_AUTH_PLAIN;
*state2 = POP3_AUTH_FINAL; *state2 = POP3_AUTH_FINAL;
pop3c->authused = SASL_MECH_PLAIN; pop3c->sasl.authused = SASL_MECH_PLAIN;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd, result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,

6
lib/pop3.h
View File

@@ -23,6 +23,7 @@
***************************************************************************/ ***************************************************************************/
#include "pingpong.h" #include "pingpong.h"
#include "curl_sasl.h"
/**************************************************************************** /****************************************************************************
* POP3 unique setup * POP3 unique setup
@@ -77,14 +78,11 @@ struct pop3_conn {
have been received so far */ have been received so far */
size_t strip; /* Number of bytes from the start to ignore as size_t strip; /* Number of bytes from the start to ignore as
non-body */ non-body */
struct SASL sasl; /* SASL-related storage */
unsigned int authtypes; /* Accepted authentication types */ unsigned int authtypes; /* Accepted authentication types */
unsigned int authmechs; /* Accepted SASL authentication mechanisms */
unsigned int preftype; /* Preferred authentication type */ unsigned int preftype; /* Preferred authentication type */
unsigned int prefmech; /* Preferred SASL authentication mechanism */
unsigned int authused; /* SASL auth mechanism used for the connection */
char *apoptimestamp; /* APOP timestamp from the server greeting */ char *apoptimestamp; /* APOP timestamp from the server greeting */
bool tls_supported; /* StartTLS capability supported by server */ bool tls_supported; /* StartTLS capability supported by server */
bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
}; };
extern const struct Curl_handler Curl_handler_pop3; extern const struct Curl_handler Curl_handler_pop3;

109
lib/smtp.c
View File

@@ -352,9 +352,9 @@ static CURLcode smtp_perform_ehlo(struct connectdata *conn)
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
struct smtp_conn *smtpc = &conn->proto.smtpc; struct smtp_conn *smtpc = &conn->proto.smtpc;
smtpc->authmechs = 0; /* No known authentication mechanisms yet */ smtpc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanism yet */
smtpc->authused = 0; /* Clear the authentication mechanism used smtpc->sasl.authused = SASL_AUTH_NONE; /* Clear the authentication mechanism
for esmtp connections */ used for esmtp connections */
smtpc->tls_supported = FALSE; /* Clear the TLS capability */ smtpc->tls_supported = FALSE; /* Clear the TLS capability */
smtpc->auth_supported = FALSE; /* Clear the AUTH capability */ smtpc->auth_supported = FALSE; /* Clear the AUTH capability */
@@ -378,8 +378,8 @@ static CURLcode smtp_perform_helo(struct connectdata *conn)
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
struct smtp_conn *smtpc = &conn->proto.smtpc; struct smtp_conn *smtpc = &conn->proto.smtpc;
smtpc->authused = 0; /* No authentication mechanism used in smtp smtpc->sasl.authused = SASL_AUTH_NONE; /* No authentication mechanism used
connections */ in smtp connections */
/* Send the HELO command */ /* Send the HELO command */
result = Curl_pp_sendf(&smtpc->pp, "HELO %s", smtpc->domain); result = Curl_pp_sendf(&smtpc->pp, "HELO %s", smtpc->domain);
@@ -571,7 +571,7 @@ static CURLcode smtp_perform_mail(struct connectdata *conn)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
/* Calculate the optional AUTH parameter */ /* Calculate the optional AUTH parameter */
if(data->set.str[STRING_MAIL_AUTH] && conn->proto.smtpc.authused) { if(data->set.str[STRING_MAIL_AUTH] && conn->proto.smtpc.sasl.authused) {
if(data->set.str[STRING_MAIL_AUTH][0] != '\0') if(data->set.str[STRING_MAIL_AUTH][0] != '\0')
auth = aprintf("%s", data->set.str[STRING_MAIL_AUTH]); auth = aprintf("%s", data->set.str[STRING_MAIL_AUTH]);
else else
@@ -772,21 +772,21 @@ static CURLcode smtp_state_ehlo_resp(struct connectdata *conn, int smtpcode,
/* Test the word for a matching authentication mechanism */ /* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN)) if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
smtpc->authmechs |= SASL_MECH_LOGIN; smtpc->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
smtpc->authmechs |= SASL_MECH_PLAIN; smtpc->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
smtpc->authmechs |= SASL_MECH_CRAM_MD5; smtpc->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
smtpc->authmechs |= SASL_MECH_DIGEST_MD5; smtpc->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
smtpc->authmechs |= SASL_MECH_GSSAPI; smtpc->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
smtpc->authmechs |= SASL_MECH_EXTERNAL; smtpc->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
smtpc->authmechs |= SASL_MECH_NTLM; smtpc->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2)) else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
smtpc->authmechs |= SASL_MECH_XOAUTH2; smtpc->sasl.authmechs |= SASL_MECH_XOAUTH2;
line += wordlen; line += wordlen;
len -= wordlen; len -= wordlen;
@@ -1171,7 +1171,8 @@ static CURLcode smtp_state_auth_gssapi_resp(struct connectdata *conn,
/* Create the initial response message */ /* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "smtp", conn->passwd, "smtp",
smtpc->mutual_auth, NULL, smtpc->sasl.mutual_auth,
NULL,
&conn->krb5, &conn->krb5,
&respmsg, &len); &respmsg, &len);
if(!result && respmsg) { if(!result && respmsg) {
@@ -1210,11 +1211,11 @@ static CURLcode smtp_state_auth_gssapi_token_resp(struct connectdata *conn,
/* Get the challenge message */ /* Get the challenge message */
smtp_get_message(data->state.buffer, &chlgmsg); smtp_get_message(data->state.buffer, &chlgmsg);
if(smtpc->mutual_auth) if(smtpc->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response /* Decode the user token challenge and create the optional response
message */ message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL, result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
smtpc->mutual_auth, smtpc->sasl.mutual_auth,
chlgmsg, &conn->krb5, chlgmsg, &conn->krb5,
&respmsg, &len); &respmsg, &len);
else else
@@ -1240,7 +1241,7 @@ static CURLcode smtp_state_auth_gssapi_token_resp(struct connectdata *conn,
result = Curl_pp_sendf(&smtpc->pp, "%s", ""); result = Curl_pp_sendf(&smtpc->pp, "%s", "");
if(!result) if(!result)
state(conn, (smtpc->mutual_auth ? SMTP_AUTH_GSSAPI_NO_DATA : state(conn, (smtpc->sasl.mutual_auth ? SMTP_AUTH_GSSAPI_NO_DATA :
SMTP_AUTH_FINAL)); SMTP_AUTH_FINAL));
} }
} }
@@ -1353,7 +1354,7 @@ static CURLcode smtp_state_auth_cancel_resp(struct connectdata *conn,
(void)instate; /* no use for this yet */ (void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */ /* Remove the offending mechanism from the supported list */
smtpc->authmechs ^= smtpc->authused; smtpc->sasl.authmechs ^= smtpc->sasl.authused;
/* Calculate alternative SASL login details */ /* Calculate alternative SASL login details */
result = smtp_calc_sasl_details(conn, &mech, &initresp, &len, &state1, result = smtp_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
@@ -1767,7 +1768,7 @@ static CURLcode smtp_connect(struct connectdata *conn, bool *done)
pp->conn = conn; pp->conn = conn;
/* Set the default preferred authentication mechanism */ /* Set the default preferred authentication mechanism */
smtpc->prefmech = SASL_AUTH_ANY; smtpc->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */ /* Initialise the pingpong layer */
Curl_pp_init(pp); Curl_pp_init(pp);
@@ -1985,7 +1986,7 @@ static CURLcode smtp_disconnect(struct connectdata *conn, bool dead_connection)
Curl_pp_disconnect(&smtpc->pp); Curl_pp_disconnect(&smtpc->pp);
/* Cleanup the SASL module */ /* Cleanup the SASL module */
Curl_sasl_cleanup(conn, smtpc->authused); Curl_sasl_cleanup(conn, smtpc->sasl.authused);
/* Cleanup our connection based variables */ /* Cleanup our connection based variables */
Curl_safefree(smtpc->domain); Curl_safefree(smtpc->domain);
@@ -2122,7 +2123,7 @@ static CURLcode smtp_parse_url_options(struct connectdata *conn)
if(reset) { if(reset) {
reset = FALSE; reset = FALSE;
smtpc->prefmech = SASL_AUTH_NONE; smtpc->sasl.prefmech = SASL_AUTH_NONE;
} }
while(*ptr && *ptr != ';') { while(*ptr && *ptr != ';') {
@@ -2131,21 +2132,21 @@ static CURLcode smtp_parse_url_options(struct connectdata *conn)
} }
if(strnequal(value, "*", len)) if(strnequal(value, "*", len))
smtpc->prefmech = SASL_AUTH_ANY; smtpc->sasl.prefmech = SASL_AUTH_ANY;
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) else if(strnequal(value, SASL_MECH_STRING_LOGIN, len))
smtpc->prefmech |= SASL_MECH_LOGIN; smtpc->sasl.prefmech |= SASL_MECH_LOGIN;
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) else if(strnequal(value, SASL_MECH_STRING_PLAIN, len))
smtpc->prefmech |= SASL_MECH_PLAIN; smtpc->sasl.prefmech |= SASL_MECH_PLAIN;
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len))
smtpc->prefmech |= SASL_MECH_CRAM_MD5; smtpc->sasl.prefmech |= SASL_MECH_CRAM_MD5;
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len))
smtpc->prefmech |= SASL_MECH_DIGEST_MD5; smtpc->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len))
smtpc->prefmech |= SASL_MECH_GSSAPI; smtpc->sasl.prefmech |= SASL_MECH_GSSAPI;
else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) else if(strnequal(value, SASL_MECH_STRING_NTLM, len))
smtpc->prefmech |= SASL_MECH_NTLM; smtpc->sasl.prefmech |= SASL_MECH_NTLM;
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len))
smtpc->prefmech |= SASL_MECH_XOAUTH2; smtpc->sasl.prefmech |= SASL_MECH_XOAUTH2;
if(*ptr == ';') if(*ptr == ';')
ptr++; ptr++;
@@ -2221,46 +2222,46 @@ static CURLcode smtp_calc_sasl_details(struct connectdata *conn,
/* Calculate the supported authentication mechanism, by decreasing order of /* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */ security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5) #if defined(USE_KERBEROS5)
if((smtpc->authmechs & SASL_MECH_GSSAPI) && if((smtpc->sasl.authmechs & SASL_MECH_GSSAPI) &&
(smtpc->prefmech & SASL_MECH_GSSAPI)) { (smtpc->sasl.prefmech & SASL_MECH_GSSAPI)) {
smtpc->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ smtpc->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI; *mech = SASL_MECH_STRING_GSSAPI;
*state1 = SMTP_AUTH_GSSAPI; *state1 = SMTP_AUTH_GSSAPI;
*state2 = SMTP_AUTH_GSSAPI_TOKEN; *state2 = SMTP_AUTH_GSSAPI_TOKEN;
smtpc->authused = SASL_MECH_GSSAPI; smtpc->sasl.authused = SASL_MECH_GSSAPI;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user, result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "smtp", conn->passwd, "smtp",
smtpc->mutual_auth, smtpc->sasl.mutual_auth,
NULL, &conn->krb5, NULL, &conn->krb5,
initresp, len); initresp, len);
} }
else else
#endif #endif
#ifndef CURL_DISABLE_CRYPTO_AUTH #ifndef CURL_DISABLE_CRYPTO_AUTH
if((smtpc->authmechs & SASL_MECH_DIGEST_MD5) && if((smtpc->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
(smtpc->prefmech & SASL_MECH_DIGEST_MD5)) { (smtpc->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5; *mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = SMTP_AUTH_DIGESTMD5; *state1 = SMTP_AUTH_DIGESTMD5;
smtpc->authused = SASL_MECH_DIGEST_MD5; smtpc->sasl.authused = SASL_MECH_DIGEST_MD5;
} }
else if((smtpc->authmechs & SASL_MECH_CRAM_MD5) && else if((smtpc->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
(smtpc->prefmech & SASL_MECH_CRAM_MD5)) { (smtpc->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5; *mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = SMTP_AUTH_CRAMMD5; *state1 = SMTP_AUTH_CRAMMD5;
smtpc->authused = SASL_MECH_CRAM_MD5; smtpc->sasl.authused = SASL_MECH_CRAM_MD5;
} }
else else
#endif #endif
#ifdef USE_NTLM #ifdef USE_NTLM
if((smtpc->authmechs & SASL_MECH_NTLM) && if((smtpc->sasl.authmechs & SASL_MECH_NTLM) &&
(smtpc->prefmech & SASL_MECH_NTLM)) { (smtpc->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM; *mech = SASL_MECH_STRING_NTLM;
*state1 = SMTP_AUTH_NTLM; *state1 = SMTP_AUTH_NTLM;
*state2 = SMTP_AUTH_NTLM_TYPE2MSG; *state2 = SMTP_AUTH_NTLM_TYPE2MSG;
smtpc->authused = SASL_MECH_NTLM; smtpc->sasl.authused = SASL_MECH_NTLM;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd, result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
@@ -2269,35 +2270,35 @@ static CURLcode smtp_calc_sasl_details(struct connectdata *conn,
} }
else else
#endif #endif
if(((smtpc->authmechs & SASL_MECH_XOAUTH2) && if(((smtpc->sasl.authmechs & SASL_MECH_XOAUTH2) &&
(smtpc->prefmech & SASL_MECH_XOAUTH2) && (smtpc->sasl.prefmech & SASL_MECH_XOAUTH2) &&
(smtpc->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) { (smtpc->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2; *mech = SASL_MECH_STRING_XOAUTH2;
*state1 = SMTP_AUTH_XOAUTH2; *state1 = SMTP_AUTH_XOAUTH2;
*state2 = SMTP_AUTH_FINAL; *state2 = SMTP_AUTH_FINAL;
smtpc->authused = SASL_MECH_XOAUTH2; smtpc->sasl.authused = SASL_MECH_XOAUTH2;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user, result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer, conn->xoauth2_bearer,
initresp, len); initresp, len);
} }
else if((smtpc->authmechs & SASL_MECH_LOGIN) && else if((smtpc->sasl.authmechs & SASL_MECH_LOGIN) &&
(smtpc->prefmech & SASL_MECH_LOGIN)) { (smtpc->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN; *mech = SASL_MECH_STRING_LOGIN;
*state1 = SMTP_AUTH_LOGIN; *state1 = SMTP_AUTH_LOGIN;
*state2 = SMTP_AUTH_LOGIN_PASSWD; *state2 = SMTP_AUTH_LOGIN_PASSWD;
smtpc->authused = SASL_MECH_LOGIN; smtpc->sasl.authused = SASL_MECH_LOGIN;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len); result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
} }
else if((smtpc->authmechs & SASL_MECH_PLAIN) && else if((smtpc->sasl.authmechs & SASL_MECH_PLAIN) &&
(smtpc->prefmech & SASL_MECH_PLAIN)) { (smtpc->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN; *mech = SASL_MECH_STRING_PLAIN;
*state1 = SMTP_AUTH_PLAIN; *state1 = SMTP_AUTH_PLAIN;
*state2 = SMTP_AUTH_FINAL; *state2 = SMTP_AUTH_FINAL;
smtpc->authused = SASL_MECH_PLAIN; smtpc->sasl.authused = SASL_MECH_PLAIN;
if(data->set.sasl_ir) if(data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd, result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,

6
lib/smtp.h
View File

@@ -23,6 +23,7 @@
***************************************************************************/ ***************************************************************************/
#include "pingpong.h" #include "pingpong.h"
#include "curl_sasl.h"
/**************************************************************************** /****************************************************************************
* SMTP unique setup * SMTP unique setup
@@ -79,14 +80,11 @@ struct smtp_conn {
smtpstate state; /* Always use smtp.c:state() to change state! */ smtpstate state; /* Always use smtp.c:state() to change state! */
bool ssldone; /* Is connect() over SSL done? */ bool ssldone; /* Is connect() over SSL done? */
char *domain; /* Client address/name to send in the EHLO */ char *domain; /* Client address/name to send in the EHLO */
unsigned int authmechs; /* Accepted authentication mechanisms */ struct SASL sasl; /* SASL-related storage */
unsigned int prefmech; /* Preferred authentication mechanism */
unsigned int authused; /* Auth mechanism used for the connection */
bool tls_supported; /* StartTLS capability supported by server */ bool tls_supported; /* StartTLS capability supported by server */
bool size_supported; /* If server supports SIZE extension according to bool size_supported; /* If server supports SIZE extension according to
RFC 1870 */ RFC 1870 */
bool auth_supported; /* AUTH capability supported by server */ bool auth_supported; /* AUTH capability supported by server */
bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
}; };
extern const struct Curl_handler Curl_handler_smtp; extern const struct Curl_handler Curl_handler_smtp;